Malicious code in blue-string-formatter-utils (npm)
MAL-2026-16273
Published · Modified
Dependency scanning
Check whether blue-string-formatter-utils is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565)
The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET to the protocol-relative URL //xss.report/c/k3rne111 whose response body is passed directly to eval(). Any require()/import of this package causes arbitrary attacker-controlled JavaScript from xss.report to execute in the consumer's Node process, with no pinning, no integrity check, and no relationship to the advertised functionality. The mismatch between the package's stated purpose (string utilities) and its actual contents (a remote-code loader) is a cover-story pattern.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes